1 / 6

Deploying DNSSEC

Deploying DNSSEC. Ram Mohan. Initial Setup (occurs once) Setup conf file with original zones and parameters Set serial to first value, and add in resource records Operations (Very Infrequently): Add to conf file when new zone comes online Make change to resource records and increment serial

harrison-mcintyre
Download Presentation

Deploying DNSSEC

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Deploying DNSSEC Ram Mohan

  2. Initial Setup (occurs once) Setup conf file with original zones and parameters Set serial to first value, and add in resource records Operations (Very Infrequently): Add to conf file when new zone comes online Make change to resource records and increment serial Monitoring: check that update made just happened and hit secondaries check that DNS, NTP is running check that transfers are working DNS Admin – Pre DNSSEC

  3. DNSSEC Setup (occurs once) Decide on signing solution, signing frequency, signature expiration, key rolls Generate initial keys Sign zone(s) initially Make sure registrar supports DNSSEC Generate initial DS records - and send to registrar DNSSEC operation (very infrequently) Generate new keys Generate new DS record (if rolling KSK), send to registrar Begin signing with new keys Deprecate old keys at appropriate time DNS Admin – Post DNSSEC

  4. DNSSEC operation (frequent) Re-sign zone Sign new records as they come into the zone Monitoring Check signatures are valid Check NSEC / NSEC3 records are valid Check signatures will not expire before next zone re-sign Check zone re-signs work and transfer Check that new keys are valid Check signature with new keys valid Ensure DS in parent is in sync w/ DNSKEYs in apex DNSSEC Admin – Post DNSSEC continued

  5. Current IANA process

  6. IANA process – Challenges • The IANA process requires confirmation from BOTH admin and tech contacts for publication. • Contacts can change jobs • Contacts can change locations • Keeping IANA contact information current may not be top priority for some TLD operators • IANA will not approve changes which may affect stability/service for the TLD • Nameservers in in the TLDs apex NS Set must be upgraded to "DNSSEC-Ready" versions

More Related